Struct ExpandedSecretKey 

pub struct ExpandedSecretKey {
    pub scalar: Scalar,
    pub hash_prefix: [u8; 32],
}

Contains the secret scalar and domain separator used for generating signatures.

This is used internally for signing.

In the usual Ed25519 signing algorithm, scalar and hash_prefix are defined such that scalar || hash_prefix = H(sk) where sk is the signing key and H is SHA-512. WARNING: Deriving the values for these fields in any other way can lead to full key recovery, as documented in raw_sign and [raw_sign_prehashed].

Instances of this secret are automatically overwritten with zeroes when they fall out of scope.

Fields

scalar: Scalar

The secret scalar used for signing

hash_prefix: [u8; 32]

The domain separator used when hashing the message to generate the pseudorandom r value

Implementations

impl ExpandedSecretKey

pub(crate) fn raw_sign<CtxDigest>( &self, message: &[&[u8]], verifying_key: &VerifyingKey, ) -> Signature

where CtxDigest: Digest<OutputSize = U64>,

The plain, non-prehashed, signing function for Ed25519. CtxDigest is the digest used to calculate the pseudorandomness needed for signing. According to the spec, CtxDigest = Sha512, and self is derived via the method defined in impl From<&SigningKey> for ExpandedSecretKey.

This definition is loose in its parameters so that end-users of the hazmat module can change how the ExpandedSecretKey is calculated and which hash function to use.

pub(crate) fn raw_sign_byupdate<CtxDigest, F>( &self, msg_update: F, verifying_key: &VerifyingKey, ) -> Result<Signature, SignatureError>

where CtxDigest: Digest<OutputSize = U64>, F: Fn(&mut CtxDigest) -> Result<(), SignatureError>,

Sign a message provided in parts. The msg_update closure will be called twice to hash the message parts. This closure MUST leave its hasher in the same state (i.e., must hash the same values) after both calls. Otherwise it will produce an invalid signature.

impl ExpandedSecretKey

pub fn from_bytes(bytes: &[u8; 64]) -> Self

Construct an ExpandedSecretKey from an array of 64 bytes. In the spec, the bytes are the output of a SHA-512 hash. This clamps the first 32 bytes and uses it as a scalar, and uses the second 32 bytes as a domain separator for hashing.

pub fn from_slice(bytes: &[u8]) -> Result<Self, SignatureError>

Construct an ExpandedSecretKey from a slice of 64 bytes.

Returns

A Result whose okay value is an EdDSA ExpandedSecretKey or whose error value is an SignatureError describing the error that occurred, namely that the given slice’s length is not 64.

Trait Implementations

impl ConstantTimeEq for ExpandedSecretKey

fn ct_eq(&self, other: &Self) -> Choice

Determine if two items are equal.

fn ct_ne(&self, other: &Self) -> Choice

Determine if two items are NOT equal.

impl Debug for ExpandedSecretKey

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for ExpandedSecretKey

Available on crate feature zeroize only.

fn drop(&mut self)

Executes the destructor for this type.

impl From<&[u8; 32]> for ExpandedSecretKey

The spec-compliant way to define an expanded secret key. This computes SHA512(sk), clamps the first 32 bytes and uses it as a scalar, and uses the second 32 bytes as a domain separator for hashing.

fn from(secret_key: &SecretKey) -> ExpandedSecretKey

Converts to this type from the input type.

impl From<&ExpandedSecretKey> for VerifyingKey

fn from(expanded_secret_key: &ExpandedSecretKey) -> VerifyingKey

Derive this public key from its corresponding ExpandedSecretKey.

impl PartialEq for ExpandedSecretKey

fn eq(&self, other: &Self) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl TryFrom<&[u8]> for ExpandedSecretKey

type Error = Error

The type returned in the event of a conversion error.

fn try_from(bytes: &[u8]) -> Result<Self, Self::Error>

Performs the conversion.

impl Eq for ExpandedSecretKey

impl ZeroizeOnDrop for ExpandedSecretKey

Available on crate feature zeroize only.